RE: https://mastodon.online/@larsmb/116017796592641161
The funny thing is... if curl added checksum calculation that was pipe-able like so:
$ curl --check-sha256 abcdef... https://... | sh -
...that may actually be useful in a "check that a checksum has provenance, if yes then " | sh -" a script with that checksum otherwise abort. You can verify Sigstore provenance of a SHA256 checksum, for example, prior to running a script. Maybe it would be useful in other ways, too?